I agree the developer is at fault, and never should have done what he did without warning. If someone tells me first that I have to accept ads / spam, I may or may not decide it's worth it. If they don't warn me first, I'll never trust them again.
What I find foolish is the folks blaming Mozilla. How are they supposed to check every little update that comes along? I think some of the responsibility lies with the users. I mean, even when developers act in good faith, sometimes they make changes you aren't happy with. If you just blindly allow everything to be updated automatically, you're taking some risk you'll be unhappy with the result. In this case, the developer was also at fault, no question. But users need to pay attention to what is happening on their systems (unless they want to be one of those guys who just accepts whatever comes up on their screen - and then I think they'll be getting some nasty surprises pretty quickly).
I mean, malware authors all deserve a good kick in the head, and nothing absolves them of the responsibility for spreading their crap. But, hate it or not, it does exist. If you just press "Yes" whenever a box pops up on your screen, or you set your system to automatically accept whatever updates are pushed at it, sooner or later, you're going to wind up with junk on your hard drive you never put there and don't want there.